Emotes: allow automatic width/height

anonstream/helpers/chat.py

@@ -23,10 +23,12 @@ def get_scrollback(messages):
 @lru_cache
 def get_emote_markup(emote_name, emote_file, emote_width, emote_height):
     emote_name_markup = escape(emote_name)
+    width = '' if emote_width is None else f'width="{escape(emote_width)}" '
+    height = '' if emote_height is None else f'height="{escape(emote_height)}" '
     return Markup(
         f'''<img class="emote" '''
-        f'''src="{url_for('static', filename=emote_file)}" '''
-        f'''width="{escape(emote_width)}" height="{escape(emote_height)}" '''
+        f'''src="{escape(url_for('static', filename=emote_file))}" ''' # XXX cherry-pick security fix
+        f'''{width}{height}'''
         f'''alt="{emote_name_markup}" title="{emote_name_markup}">'''
     )
 

anonstream/utils/chat.py

@@ -35,10 +35,13 @@ def precompute_emote_regex(schema):
     for emote in schema:
         assert emote['name'], 'emote names cannot be empty'
         assert not re.search(r'\s', emote['name']), \
-            'whitespace is not allowed in emote names'
+            f'whitespace is not allowed in emote names: {emote["name"]!r}'
+        for length in (emote['width'], emote['height']):
+            assert length is None or isinstance(length, int) and length >= 0, \
+                f'emote dimensions must be null or non-negative integers: {emote["name"]!r}'
         # If the emote name begins with a word character [a-zA-Z0-9_],
         # match only if preceded by a non-word character or the empty
-        # string. Similarly for the end of the emote name.
+        # string.  Similarly for the end of the emote name.
         # Examples:
         #  * ":joy:" matches "abc :joy:~xyz"   and   "abc:joy:xyz"
         #  * "JoySi" matches "abc JoySi~xyz" but NOT "abcJoySiabc"